Nov  6 07:22:00 nextcloud sshd\[19035\]: Invalid user jin from 159.203.7.104
Nov  6 07:22:00 nextcloud sshd\[19035\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.7.104
Nov  6 07:22:02 nextcloud sshd\[19035\]: Failed password for invalid user jin from 159.203.7.104 port 34632 ssh2
...

Nov  5 22:45:35 webhost01 sshd[5995]: Failed password for root from 159.203.7.104 port 59884 ssh2
...

Invalid user zf from 159.203.7.104 port 55084

Oct 23 12:19:44 OPSO sshd\[8172\]: Invalid user capensis from 159.203.7.104 port 41964
Oct 23 12:19:44 OPSO sshd\[8172\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.7.104
Oct 23 12:19:46 OPSO sshd\[8172\]: Failed password for invalid user capensis from 159.203.7.104 port 41964 ssh2
Oct 23 12:23:46 OPSO sshd\[8991\]: Invalid user postmaster from 159.203.7.104 port 52450
Oct 23 12:23:46 OPSO sshd\[8991\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.7.104

Oct 18 15:33:39 markkoudstaal sshd[3995]: Failed password for root from 159.203.7.104 port 35450 ssh2
Oct 18 15:37:49 markkoudstaal sshd[4375]: Failed password for root from 159.203.7.104 port 46990 ssh2

Oct 10 11:44:34 server sshd\[16367\]: User root from 159.203.7.104 not allowed because listed in DenyUsers
Oct 10 11:44:34 server sshd\[16367\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.7.104  user=root
Oct 10 11:44:36 server sshd\[16367\]: Failed password for invalid user root from 159.203.7.104 port 58242 ssh2
Oct 10 11:48:33 server sshd\[26509\]: User root from 159.203.7.104 not allowed because listed in DenyUsers
Oct 10 11:48:33 server sshd\[26509\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.7.104  user=root

Oct  6 12:25:42 kmh-wsh-001-nbg03 sshd[30860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.7.104  user=r.r
Oct  6 12:25:44 kmh-wsh-001-nbg03 sshd[30860]: Failed password for r.r from 159.203.7.104 port 51410 ssh2
Oct  6 12:25:44 kmh-wsh-001-nbg03 sshd[30860]: Received disconnect from 159.203.7.104 port 51410:11: Bye Bye [preauth]
Oct  6 12:25:44 kmh-wsh-001-nbg03 sshd[30860]: Disconnected from 159.203.7.104 port 51410 [preauth]
Oct  6 12:34:26 kmh-wsh-001-nbg03 sshd[31139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.7.104  user=r.r
Oct  6 12:34:28 kmh-wsh-001-nbg03 sshd[31139]: Failed password for r.r from 159.203.7.104 port 35972 ssh2
Oct  6 12:34:29 kmh-wsh-001-nbg03 sshd[31139]: Received disconnect from 159.203.7.104 port 35972:11: Bye Bye [preauth]
Oct  6 12:34:29 kmh-wsh-001-nbg03 sshd[31139]: Disconnected from 159.203.7.104 port 35972 [preauth]
Oct  6 12:38:10 ........
-------------------------------

Invalid user vz from 159.203.74.227 port 43554

Oct 12 22:55:14 mavik sshd[13085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.74.227  user=root
Oct 12 22:55:16 mavik sshd[13085]: Failed password for root from 159.203.74.227 port 35866 ssh2
Oct 12 22:59:31 mavik sshd[13749]: Invalid user wildaliz from 159.203.74.227
Oct 12 22:59:31 mavik sshd[13749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.74.227
Oct 12 22:59:33 mavik sshd[13749]: Failed password for invalid user wildaliz from 159.203.74.227 port 39348 ssh2
...

srv02 Mass scanning activity detected Target: 8088(omniorb) ..

firewall-block, port(s): 8088/tcp

Found on   Github Combined on 5 lists    / proto=6  .  srcport=57514  .  dstport=8088  .     (632)

Oct 10 23:50:34 XXXXXX sshd[62085]: Invalid user admin from 159.203.78.201 port 34722

159.203.70.169 - - [08/Oct/2020:19:11:15 +0100] "POST /wp/wp-login.php HTTP/1.1" 200 2417 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
159.203.70.169 - - [08/Oct/2020:19:11:18 +0100] "POST /wp/wp-login.php HTTP/1.1" 200 2441 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
159.203.70.169 - - [08/Oct/2020:19:11:19 +0100] "POST /wp/xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Port Scan
...

159.203.70.169 - - [08/Oct/2020:10:26:07 +0200] "GET /wp-login.php HTTP/1.1" 200 8796 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
159.203.70.169 - - [08/Oct/2020:10:26:08 +0200] "POST /wp-login.php HTTP/1.1" 200 9047 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
159.203.70.169 - - [08/Oct/2020:10:26:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

[portscan] tcp/22 [SSH]
in blocklist.de:'listed [ssh]'
*(RWIN=65535)(10080947)

2020-10-07 10:50:27.001157-0500  localhost sshd[54641]: Failed password for root from 159.203.73.181 port 55760 ssh2

2020-10-07T10:57:14.322676snf-827550 sshd[15960]: Failed password for root from 159.203.73.181 port 39767 ssh2
2020-10-07T11:00:46.698402snf-827550 sshd[16012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=joinlincoln.org  user=root
2020-10-07T11:00:49.320647snf-827550 sshd[16012]: Failed password for root from 159.203.73.181 port 42762 ssh2
...

2020-10-03T19:03:06.170324abusebot-8.cloudsearch.cf sshd[2582]: Invalid user serveur from 159.203.73.181 port 59313
2020-10-03T19:03:06.175830abusebot-8.cloudsearch.cf sshd[2582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=joinlincoln.org
2020-10-03T19:03:06.170324abusebot-8.cloudsearch.cf sshd[2582]: Invalid user serveur from 159.203.73.181 port 59313
2020-10-03T19:03:08.547295abusebot-8.cloudsearch.cf sshd[2582]: Failed password for invalid user serveur from 159.203.73.181 port 59313 ssh2
2020-10-03T19:06:29.198484abusebot-8.cloudsearch.cf sshd[2674]: Invalid user kai from 159.203.73.181 port 34638
2020-10-03T19:06:29.206658abusebot-8.cloudsearch.cf sshd[2674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=joinlincoln.org
2020-10-03T19:06:29.198484abusebot-8.cloudsearch.cf sshd[2674]: Invalid user kai from 159.203.73.181 port 34638
2020-10-03T19:06:31.113161abusebot-8.cloudsearch.cf sshd[2674]: Fai
...

Time:     Sun Sep 27 00:29:44 2020 +0000
IP:       159.203.73.181 (US/United States/joinlincoln.org)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 27 00:26:36 activeserver sshd[15040]: Invalid user b from 159.203.73.181 port 60160
Sep 27 00:26:38 activeserver sshd[15040]: Failed password for invalid user b from 159.203.73.181 port 60160 ssh2
Sep 27 00:28:09 activeserver sshd[18327]: Invalid user zhao from 159.203.73.181 port 51066
Sep 27 00:28:11 activeserver sshd[18327]: Failed password for invalid user zhao from 159.203.73.181 port 51066 ssh2
Sep 27 00:29:39 activeserver sshd[21552]: Invalid user admin1 from 159.203.73.181 port 41962

$f2bV_matches

May 21 02:17:33 vps687878 sshd\[32356\]: Failed password for invalid user ker from 137.74.132.171 port 57836 ssh2
May 21 02:20:52 vps687878 sshd\[32712\]: Invalid user shs from 137.74.132.171 port 36202
May 21 02:20:52 vps687878 sshd\[32712\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.74.132.171
May 21 02:20:55 vps687878 sshd\[32712\]: Failed password for invalid user shs from 137.74.132.171 port 36202 ssh2
May 21 02:24:17 vps687878 sshd\[424\]: Invalid user wdi from 137.74.132.171 port 42796
May 21 02:24:17 vps687878 sshd\[424\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.74.132.171
...

(From eric@talkwithwebvisitor.com) Hello, my name’s Eric and I just ran across your website at northshorechiropractic.com...

I found it after a quick search, so your SEO’s working out…

Content looks pretty good…

One thing’s missing though…

A QUICK, EASY way to connect with you NOW.

Because studies show that a web lead like me will only hang out a few seconds – 7 out of 10 disappear almost instantly, Surf Surf Surf… then gone forever.

I have the solution:

Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  You’ll know immediately they’re interested and you can call them directly to TALK with them - literally while they’re still on the web looking at your site.

CLICK HERE http://www.talkwithwebvisitor.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works and even give it a try… it could be huge for your business.

Plus, now that you’ve got that phone number, with our

Found by fail2ban

May 21 00:06:12 ip-172-31-61-156 sshd[4415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.41  user=root
May 21 00:06:14 ip-172-31-61-156 sshd[4415]: Failed password for root from 222.186.180.41 port 37382 ssh2
...

May 21 02:03:00 minden010 sshd[3204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.12.24
May 21 02:03:02 minden010 sshd[3204]: Failed password for invalid user xvv from 192.99.12.24 port 53710 ssh2
May 21 02:03:39 minden010 sshd[3294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.12.24
...

05/20/2020-19:39:15.730311 219.138.150.220 Protocol: 6 ET SCAN NMAP -sS window 1024

fail2ban/May 20 23:57:36 h1962932 sshd[3208]: Invalid user qoh from 182.253.184.20 port 38558
May 20 23:57:36 h1962932 sshd[3208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.253.184.20
May 20 23:57:36 h1962932 sshd[3208]: Invalid user qoh from 182.253.184.20 port 38558
May 20 23:57:38 h1962932 sshd[3208]: Failed password for invalid user qoh from 182.253.184.20 port 38558 ssh2
May 21 00:04:45 h1962932 sshd[5456]: Invalid user lxu from 182.253.184.20 port 60944

May 20 18:03:58 Host-KLAX-C dovecot: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=183.89.214.178, lip=185.198.26.142, TLS, session=<2LR/Px2mf4m3Wday>
...

May 21 01:04:00 sigma sshd\[16843\]: Invalid user usf from 200.206.81.154May 21 01:04:02 sigma sshd\[16843\]: Failed password for invalid user usf from 200.206.81.154 port 57969 ssh2
...

May 21 01:44:40 vayu sshd[322845]: Invalid user psa from 202.45.144.9
May 21 01:44:43 vayu sshd[322845]: Failed password for invalid user psa from 202.45.144.9 port 59781 ssh2
May 21 01:44:43 vayu sshd[322845]: Received disconnect from 202.45.144.9: 11: Bye Bye [preauth]
May 21 01:54:07 vayu sshd[326430]: Invalid user kua from 202.45.144.9


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=202.45.144.9

May 21 00:19:44 localhost sshd[108983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.174  user=root
May 21 00:19:47 localhost sshd[108983]: Failed password for root from 112.85.42.174 port 34100 ssh2
May 21 00:19:50 localhost sshd[108983]: Failed password for root from 112.85.42.174 port 34100 ssh2
May 21 00:19:44 localhost sshd[108983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.174  user=root
May 21 00:19:47 localhost sshd[108983]: Failed password for root from 112.85.42.174 port 34100 ssh2
May 21 00:19:50 localhost sshd[108983]: Failed password for root from 112.85.42.174 port 34100 ssh2
May 21 00:19:44 localhost sshd[108983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.174  user=root
May 21 00:19:47 localhost sshd[108983]: Failed password for root from 112.85.42.174 port 34100 ssh2
May 21 00:19:50 localhost sshd[108983]: F
...

1589990173 - 05/20/2020 17:56:13 Host: 177.53.240.144/177.53.240.144 Port: 8080 TCP Blocked

May 21 02:03:59 debian-2gb-nbg1-2 kernel: \[12278263.267833\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=195.54.167.12 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=62442 PROTO=TCP SPT=53841 DPT=7689 WINDOW=1024 RES=0x00 SYN URGP=0

Tried to gain access to my computer

Invalid user vww from 192.241.175.48 port 56354